How to use tcpdump to capture network packets on Linux

Why tcpdump is essential for system administrators

When an application fails to connect to a database or an external API, many administrators instinctively look at the service log files. However, when logs show only a generic timeout error, developers and operators are left guessing whether the data packet actually reached its destination. That is precisely where tcpdump becomes critical, a native Linux command-line utility that intercepts and displays network packets traversing the server interfaces. In practice, it acts like a digital stethoscope, letting you hear raw traffic exactly as it enters and leaves the network card. If you want to master infrastructure diagnostics, learning to isolate connectivity issues complements other essential skills, just as we explain in the guide on how to use journalctl to inspect Linux system logs centrally.

How to list available network interfaces on the server

Before starting any packet capture, you need to find out which server network card is actually processing the traffic you want to analyze. In modern servers, traditional names like eth0 have been replaced by predictable system-bus identifiers like enp3s0 or wlan0. To list all active and available interfaces on the operating system, run the tcpdump command accompanied by the listing parameter. This check prevents you from recording data on the wrong interface and missing the event you are trying to troubleshoot. If your network suffers from widespread latency between environments or containers, it is worth crossing this information with throughput tests using strategies similar to those described in how to use iperf3 for diagnostics.

To list available interfaces on your Linux system, open the terminal with administrative privileges and execute the following instruction:

tcpdump -D

The system will display an enumerated list containing every physical and virtual network interface present on the machine. Note down the exact number or name of the interface you want to monitor during the next steps.

How to capture basic traffic in real time

After identifying the correct interface, the next step is to start capturing raw traffic to understand connection behavior. By default, if you run the command without restrictions, tcpdump tries to translate IP addresses and port numbers into readable service names, which can slow down execution due to DNS queries. To avoid this unwanted delay and view clean data, we use the flag that disables name resolution. During incident investigations in critical environments, administrators often need to how to monitor network traffic on specific ports with tcpdump to isolate noise and focus only on the affected service.

Run the following command replacing eth0 with the interface identified in the previous step:

sudo tcpdump -i eth0 -n

Each line printed on the screen represents an individual captured packet, showing source and destination addresses, involved ports, and protocol flags. To stop execution and return to the command prompt, simply press the Ctrl + C keys.

How to filter packets by IP, port, and protocol

On high-performance servers, capturing all traffic generates an avalanche of data on screen that makes manual analysis practically impossible. To solve this problem, tcpdump accepts filter expressions based on the Berkeley Packet Filter (BPF) syntax, allowing you to isolate traffic from a specific IP address, service port, or protocol like TCP, UDP, and ICMP. In practice, this means you can restrict listening only to packets destined for the database on port 5432 or originated by the IP of a client experiencing access issues.

To capture only TCP packets directed to port 80 on the eth0 interface, use the following command:

sudo tcpdump -i eth0 -n tcp port 80

You can also combine multiple criteria using logical operators such as and, or, and not. For example, to isolate traffic from a specific IP talking to a dedicated port, type:

sudo tcpdump -i eth0 -n host 192.168.1.50 and port 443

How to save and analyze network captures in pcap files

Often, diagnosing a complex problem in real time is impractical due to the speed at which packets fly across the screen. The best strategy in these cases is to save the raw data stream directly into a file with a .pcap extension for later detailed inspection or sharing with other engineers. The generated file preserves all binary details of the captured packets, allowing you to use command-line utilities or graphical interface software like Wireshark on your own workstation. This ensures that the production downtime window remains as short as possible.

To record the capture directly into a file, use the write parameter:

sudo tcpdump -i eth0 -n -w diagnostics.pcap port 3306

To read the contents of that file later without needing to rerun the capture on the server network, use the read parameter:

tcpdump -r diagnostics.pcap -n

Final thoughts on using tcpdump

Mastering tcpdump transforms how system administrators troubleshoot network issues, eliminating guesswork and revealing exactly what happens at the packet level. By combining precise filters, pcap file saving, and knowledge of foundational protocols, any connectivity incident stops being an insurmountable mystery. Always remember to stop captures after your investigation ends to prevent unnecessary disk space consumption and processing overhead on the server.